installing Elasticsearch on a local Linux VM
✅ Prerequisites
- Local VM (VirtualBox / VMware)
- OS: Ubuntu 20.04 / 22.04
- RAM: Minimum 4 GB (8 GB recommended)
- User with sudo access
- Internet access
🔹 Step 1: Update the System
sudo apt update && sudo apt upgrade -y
🔹 Step 2: Install Java (Required)
Elasticsearch 8.x ships with its own JDK, but installing OpenJDK is still good practice.
sudo apt install openjdk-17-jdk -y
Verify:
java -version
🔹 Step 3: Download & Install Elasticsearch
Import GPG key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
Add Elasticsearch repository
sudo apt install apt-transport-https -y
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
Install Elasticsearch
sudo apt update
sudo apt install elasticsearch -y
🔹 Step 4: Configure Elasticsearch
Edit the config file:
sudo nano /etc/elasticsearch/elasticsearch.yml
Set these important values:
network.host: 0.0.0.0
http.port: 9200
discovery.type: single-node
Save and exit.
🔹 Step 5: Start & Enable Elasticsearch
sudo systemctl daemon-reexec
sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch
Check status:
sudo systemctl status elasticsearch
🔹 Step 6: Allow Port (If Firewall Enabled)
sudo ufw allow 9200
🔹 Step 7: Test Elasticsearch
From the VM:
curl http://localhost:9200
From host machine:
curl http://VM_IP:9200
✅ You should see JSON output with cluster info.
🔐 Elasticsearch 8.x Security Note
By default, security is enabled.
During installation, Elasticsearch generates:
- elastic user password
- TLS certificates
You can reset the password:
sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic
Test with auth:
curl -u elastic http://localhost:9200
🧠 Common Troubleshooting
Check logs
sudo journalctl -u elasticsearch
Increase memory (important for VMs)
Edit:
sudo nano /etc/elasticsearch/jvm.options
Set:
-Xms2g
-Xmx2g
📌 What You Can Do Next
- Install Kibana
- Build ELK Stack (Elasticsearch + Logstash + Kibana)
- Use it for:
- SOC / SIEM labs
- Log analysis
- DevOps monitoring
- Cybersecurity detection